The Agent Skills Directory

Hardcoded Documentation Search Key: The documentation search functionality in remotion-docs/REFERENCE.md uses a hardcoded Algolia API key (3e42dbd4f895fe93ff5cf40d860c4a85). While this is typically a public key restricted to search-only actions, hardcoding any credentials represents a pattern that could lead to credential exposure if the key possesses more permissions than intended.
Indirect Prompt Injection Surface: The skill ingests untrusted data from multiple ingestion points, including documentation search results and Markdown fetching in remotion-docs/REFERENCE.md, subtitle file parsing in remotion-captions/import-srt-captions.md, and remote metadata URL fetching in calculate-metadata.md. The skill lacks explicit boundary markers or sanitization for this external content before it is incorporated into the agent's context to influence code generation. This creates a surface where compromised external data could potentially provide hidden instructions to the agent. Capability inventory includes package installation (npm install), CLI execution (npx), and file writes in preprocessing scripts.
External Downloads and Dependency Installation: The skill provides instructions for installing numerous Node.js packages and using CLI tools that download external assets. Key examples include npx create-video@latest for project scaffolding in remotion-create/REFERENCE.md, npx remotion upgrade in remotion-upgrade/REFERENCE.md, and the installWhisperCpp function in remotion-captions/transcribe-captions.md which downloads and installs binary tools. These are standard operations for a developer tool but involve running code from remote sources.
Command Execution and Project Utility Scripts: Included scripts such as prep-cesium-path.mjs and prep-geo.mjs use Node.js fs APIs to read from and write to project directories. These scripts are intended for geospatial data preparation but represent a dynamic execution surface that could be misused if invoked with malicious arguments.
Local Server Execution: Instructions in remotion-studio/REFERENCE.md guide the agent to start a local preview server using npx remotion studio, which opens a network port and executes long-running processes on the host machine.

remotion-best-practices